CVE-2026-98249 arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc
A missing argument in the ARM64 hibernation resume path causes a system hang when page poisoning is enabled, requiring local high-privilege access to trigger.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98249?
CVE-2026-98249 is a denial of service vulnerability in Linux, published on 6 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc
swsusp_arch_suspend_exit() reinstalls the restored kernel's hyp stub vectors with an hvc, but never passes the arguments. x0 is not set to HVC_SET_VECTORS and x1 is not set to the vector address, so the stub dispatch falls through and returns without writing vbar_el2. EL2 is left pointing at the trans_pgd copy of the vectors, a page that swsusp_free() releases right after resume.
Set the arguments up the same way __hyp_set_vectors() does.
Without this fix, Vladimir was able to trigger a hang when resuming from hibernation with CONFIG_PAGE_POISONING=y and page_poison=on.
Which versions are affected by CVE-2026-98249?
How do I fix CVE-2026-98249?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-98249 being exploited?
There is no known exploitation of CVE-2026-98249 in the wild and no public exploit code.
Sources
Also known as AZL-106455, BELL-CVE-2026-98249, DEBIAN-CVE-2026-98249, GHSA-fm6m-qcv7-63xp, UBUNTU-CVE-2026-98249.